A missing capability check in the FastX theme allows Subscriber-level users to run the ‘ultp_install_callback’ and ‘ultp_activate_callback’ functions, which install and activate the PostX plugin. This flaw gives authenticated attackers the ability to introduce potentially malicious code by adding plugins they did not intend to use, thereby expanding the attack surface and potentially elevating privileges if the installed plugin contains vulnerabilities. The weakness is categorized as CWE‑862, a missing authorization issue. The impact is limited to users with Subscriber access or higher, but the installed plugin may compromise the entire WordPress site.

The vulnerability affects the FastX theme for WordPress, versions 1.0.0 through 1.0.2. No specific operating system or PHP version is mentioned. Only the theme’s installation routines are affected; other WordPress core files are not listed as affected.

The CVSS score of 4.3 indicates moderate severity. An attacker only needs legitimate Subscriber credentials and the ability to access the theme’s plugin installation interface; no remote code execution or elevated privileges are required in the initial attack. Because the exploit requires an authenticated user, the risk is confined to compromised user credentials. The EPSS score is not available, and the vulnerability has not been listed in CISA KEV, suggesting no currently known widespread exploitation. Nonetheless, the ability to install arbitrary plugins is a significant security concern, especially in managed or shared hosting environments.